5 ms·

Except Twitter didn't get hacked.

by caymanjim 6y ago

pavel_lishin 6y ago
Semantics, no? Someone gained unauthorized access.
- fmpwizard 6y ago
  I think the prev. comment is accurate in the sense that Mastodon can easily be vulnerable to social engineering attacks, because as long as humans run it, humans are going to make mistakes. To be super clear, any (chat/microblogging/etc) software is going to be vulnerable to social eng attacks.
- caymanjim 6y ago
  In most cases, I do consider gaining authorized access via social engineering to be a hack. I guess this probably qualifies, but just barely. If it turns out it was just a rogue engineer then it doesn't qualify at all. It's not clear that external "hackers" gained ongoing access. If someone leveraged an insecure remote worker's PC to gain access, that counts as hacking too. I'll wait and see if we find out what the root cause was.
  - manquer 6y ago
    The hack is exploiting weak internal security controls that twitter has. Reset of email for so many high profile users requiring only one person to click a button is weak design. No Review / no approval etc . Also the amount of time for them to identify it, they had blocked tweeting the address and blocked all verified users from posting before they could find the rogue account indicates logging and analysis of their admin tool actions is also not robust. Exploiting these two vulnerabilities whether by blackmail, bribe or RAT should not make a difference to consider it a hack
627467 6y ago
Kevin Mitnick is crying somewhere...
- DyslexicAtheist 6y ago
  the only hack Kevin Mitnick ever pulled was convincing people he was a hacker.
  - 627467 6y ago
    Reading through his charges[0] regardless of what we here consider that he has done, his criminal conviction seems to imply he was considered a "hacker" by the law. [0] https://en.m.wikipedia.org/wiki/Kevin_Mitnick https://en.m.wikipedia.org/wiki/Kevin_Mitnick
  - mumblemumble 6y ago
    The words "hack" and "hacker" are cognates, but both words have evolved over time, and not all senses of the word "hacker" describe someone who produces hacks. Social engineers and script kiddies can absolutely fit under the umbrella, too, and that's been the case for roughly a quarter century now. Perhaps longer.
    - thesepeopledot 6y ago
      "Produces hacks" this isn't even a thing. Can people please stop commenting on HN threads pretending to know about hacking and making false claims.
      - mumblemumble 6y ago
        Producing hacks is a thing, even if the phrase itself is not common, and it's a thing that people were doing long before hacking/hacker had even taken on the sense of breaking into computers. Look, there are really only two general approaches to arguing over the dictionary: Trotskyism (i.e., permanent revolution), and joining with the forces of evil.
  - thesepeopledot 6y ago
    Sounds like someone is jealous of him. He was clearly a hacker.
thesepeopledot 6y ago
Yes it did.
iso8859-1 6y ago
Did it get cyberattacked, then? https://en.wikipedia.org/wiki/Talk:2020_Twitter_bitcoin_scam#Requested_move_19_July_2020 https://en.wikipedia.org/wiki/Talk:2020_Twitter_bitcoin_scam...

Except Twitter didn't get hacked.

pavel_lishin 6y ago

Semantics, no? Someone gained unauthorized access.

fmpwizard 6y ago
I think the prev. comment is accurate in the sense that Mastodon can easily be vulnerable to social engineering attacks, because as long as humans run it, humans are going to make mistakes. To be super clear, any (chat/microblogging/etc) software is going to be vulnerable to social eng attacks.
caymanjim 6y ago
In most cases, I do consider gaining authorized access via social engineering to be a hack. I guess this probably qualifies, but just barely. If it turns out it was just a rogue engineer then it doesn't qualify at all. It's not clear that external "hackers" gained ongoing access. If someone leveraged an insecure remote worker's PC to gain access, that counts as hacking too. I'll wait and see if we find out what the root cause was.
- manquer 6y ago
  The hack is exploiting weak internal security controls that twitter has. Reset of email for so many high profile users requiring only one person to click a button is weak design. No Review / no approval etc . Also the amount of time for them to identify it, they had blocked tweeting the address and blocked all verified users from posting before they could find the rogue account indicates logging and analysis of their admin tool actions is also not robust. Exploiting these two vulnerabilities whether by blackmail, bribe or RAT should not make a difference to consider it a hack

627467 6y ago

Kevin Mitnick is crying somewhere...

DyslexicAtheist 6y ago
the only hack Kevin Mitnick ever pulled was convincing people he was a hacker.
- 627467 6y ago
  Reading through his charges[0] regardless of what we here consider that he has done, his criminal conviction seems to imply he was considered a "hacker" by the law. [0] https://en.m.wikipedia.org/wiki/Kevin_Mitnick https://en.m.wikipedia.org/wiki/Kevin_Mitnick
- mumblemumble 6y ago
  The words "hack" and "hacker" are cognates, but both words have evolved over time, and not all senses of the word "hacker" describe someone who produces hacks. Social engineers and script kiddies can absolutely fit under the umbrella, too, and that's been the case for roughly a quarter century now. Perhaps longer.
  - thesepeopledot 6y ago
    "Produces hacks" this isn't even a thing. Can people please stop commenting on HN threads pretending to know about hacking and making false claims.
    - mumblemumble 6y ago
      Producing hacks is a thing, even if the phrase itself is not common, and it's a thing that people were doing long before hacking/hacker had even taken on the sense of breaking into computers. Look, there are really only two general approaches to arguing over the dictionary: Trotskyism (i.e., permanent revolution), and joining with the forces of evil.
- thesepeopledot 6y ago
  Sounds like someone is jealous of him. He was clearly a hacker.

thesepeopledot 6y ago

Yes it did.

iso8859-1 6y ago

Did it get cyberattacked, then? https://en.wikipedia.org/wiki/Talk:2020_Twitter_bitcoin_scam#Requested_move_19_July_2020 https://en.wikipedia.org/wiki/Talk:2020_Twitter_bitcoin_scam...